Read the docs
TI-2021-11031 Aliases CVE-2021-30640GHSA-36qh-35cm-5w2w

Auth weakness in JNDIRealm

Priority MEDIUM 47CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · None
Fix status
Partial Red Hat: 5 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.09886 95th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 10.0.5, 9.0.45, 8.5.65Red Hat: 4 advisoriesRed Hat: 5 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TomcatApache Tomcat 10 10.0.0-M1 to 10.0.5; Apache Tomcat 9 9.0.0.M1 to 9.0.45; Apache Tomcat 8.5 8.5.0 to 8.5.65; Apache Tomcat 7 7.0.0 to 7.0.108—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)10.0.0-M1 to before 10.0.510.0.5Patch availableGHSA-36qh-35cm-5w2w
—org.apache.tomcat:tomcat (Maven)9.0.0M1 to before 9.0.459.0.45Patch availableGHSA-36qh-35cm-5w2w
—org.apache.tomcat:tomcat (Maven)8.5.0 to before 8.5.658.5.65Patch availableGHSA-36qh-35cm-5w2w
  • Apache Tomcat VendorApache Affected Apache Tomcat 10 10.0.0-M1 to 10.0.5; Apache Tomcat 9 9.0.0.M1 to 9.0.45; Apache Tomcat 8.5 8.5.0 to 8.5.65; Apache Tomcat 7 7.0.0 to 7.0.108 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.5 Fixed in 10.0.5 Patch available GHSA-36qh-35cm-5w2w
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0M1 to before 9.0.45 Fixed in 9.0.45 Patch available GHSA-36qh-35cm-5w2w
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.0 to before 8.5.65 Fixed in 8.5.65 Patch available GHSA-36qh-35cm-5w2w

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*7.0.0 to before 7.0.109; 8.5.0 to before 8.5.66; 9.0.0 to before 9.0.46; 10.0.0 to before 10.0.6VulnerableApache
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0 – 8.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:*20.1.0VulnerableOracle
cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:*7.4.0 – 7.7.1VulnerableOracle
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.0.109; 8.5.0 to before 8.5.66; 9.0.0 to before 9.0.46; 10.0.0 to before 10.0.6 Vulnerable ·Apache
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:* Versions 20.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:* Versions 7.4.0 – 7.7.1 Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-36qh-35cm-5w2w org.apache.tomcat:tomcat (Maven) Fixed in 10.0.5 Advisory →
  • Fix · GHSA-36qh-35cm-5w2w org.apache.tomcat:tomcat (Maven) Fixed in 9.0.45 Advisory →
  • Fix · GHSA-36qh-35cm-5w2w org.apache.tomcat:tomcat (Maven) Fixed in 8.5.65 Advisory →

Red Hat 4 advisories

  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11
  • RHSA-2022:1179 Released 2022-04-12 · Red Hat rating Important
    Red Hat support for Spring Boot 2.5.10 update
    • Red Hat Support for Spring Boot 2.5.10
  • RHSA-2021:4861 Released 2021-11-30 · Red Hat rating Important
    Red Hat JBoss Web Server 5.6.0 Security release
    • Red Hat JBoss Web Server 5.6 for RHEL 7 Server jws5-tomcat-9.0.50-3.redhat_00004.1.el7jws, jws5-tomcat-admin-webapps-9.0.50-3.redhat_00004.1.el7jws, jws5-tomcat-docs-webapp-9.0.50-3.redhat_00004.1.el7jws +12
    • Red Hat JBoss Web Server 5.6 for RHEL 8 jws5-tomcat-9.0.50-3.redhat_00004.1.el8jws, jws5-tomcat-admin-webapps-9.0.50-3.redhat_00004.1.el8jws, jws5-tomcat-docs-webapp-9.0.50-3.redhat_00004.1.el8jws +10
Show 1 more Red Hat advisories
  • RHSA-2021:4863 Released 2021-11-30 · Red Hat rating Important
    Red Hat JBoss Web Server 5.6.0 Security release
    • Red Hat JBoss Web Server 5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Tomcat — DSA-4952

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2021-12641 Incorrect Transfer-Encoding handling with HTTP/1.0Priority HIGH 69
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Web Server 3AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Red Hat JBoss Web Server 5Fixed RHSA-2021:4863
Red Hat JBoss Web Server 5.6 for RHEL 7 ServerFixed RHSA-2021:4861
Red Hat JBoss Web Server 5.6 for RHEL 8Fixed RHSA-2021:4861
Red Hat Support for Spring Boot 2.5.10Fixed RHSA-2022:1179
Not affected: 8 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-30640
  2. 2026-10-03 Alias added: GHSA-36qh-35cm-5w2w
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 2

Advisory 8

Other 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences